Cycode disclosed on August 18 that NASA’s AMMOS Instrument Toolkit AIT-GUI browser console could let unauthenticated attackers issue spacecraft and instrument commands, run server-side scripts, and launch command sequences in versions through 2.5.1. The flaw is tracked as GHSA-p9r8-2q67-fp86 and was fixed in AIT-GUI 2.5.2.
The problem is simple and dangerous: the web server listened on all network interfaces, and its state-changing routes had no authentication, authorization, or cross-site request forgery protection. That meant a malicious website opened by an operator, or any reachable host, could send real command requests to the console as if an operator had clicked them.
For teams using browser-based control consoles, the trust boundary is the browser session, not just the network perimeter. If AIT-GUI sits between an operator and command infrastructure, a compromised browsing session can become command execution on the ground system even when the host looks local or firewalled.